[XPERIA X10 Android Development] biktor_gj:
Gathered Information about the kernel and mount points so far:

Kernel Version: Linux version 2.6.29-rel (semc-android@SEMC) (gcc version 4.2.1) #2 PREEMPT Wed Mar 10 16:53:36 JST 2010

(notice it's been compiled on march 10 so it might have been patched until february)

Internal flash partitions:

/dev/block/mtdblock2 /system yaffs2 ro 0 0

/dev/block/mtdblock3 /data yaffs2 rw,nosuid,nodev 0 0

/dev/block/mtdblock1 /cache yaffs2 rw,nosuid,nodev 0 0

/dev/block/loop0 /cdrom iso9660 ro 0 0

4Mb ramdisk: tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0

Inside the software update package, there are a lot of files:

update.xml -> update template, it says not to erase amss_fs.sin, maybe that's why it's empty...

preset.ta ->

Inside there's this:

// preset.ta has same format as TA file generated by FXTool

// Specification document: 69/159 35-LXE 108 116 Uen, Rev PA3

// Format:

// [TAPartition<HEX8>]{1}

// [UnitID<HEX32> UnitSize<HEX16> Data<HEX8>{UnitSize}]{n}

// (c) Sony Ericsson Mobile Communications AB, 2009

02

000008FD 0010 00 00 08 00 05 00 00 00 0E 00 00 00 08 00 00 00

00000961 0004 FE FF FF FF

amss_fs.sin -> no idea...but it seems empty as the cache 639 byte

apps_log.sin -> template for wiping mtdblock0 partition? (639 byte)

cache.sin -> template for wiping cache partition (like data partition, 639 byte)

fota0.sin -> ?

fota1.sin -> ?

boot.sin -> our beloved boot.img? (5.4 mbytes)

recovery.sin -> it looks like we have a recovery mode after all (not just safe mode)

dsp1.sin -> dsp firmware?

amss.sin -> Radio firmware?

metadata.dat -> 536 bytes, I guess it will be package metadata ;)

simlock.ta -> 1,3 kb

system_S1-SW-LIVE....sin -> 195Mb, system partition

userdata_S1-SW-LIVE....sin -> 4,8kb, template for wiping data partition, maybe it has some file in there... haven't checked yet.

Things I tried so far:

m7 exploit. It seems fixed on this kernel (that or it might need some tinkering to the code)

exit_notify() local root exploit. suid_dumpable is 0 on /proc, so useless

h00ly**** exploit. Bin4ry tried this, but it seems it didn't work either.

Good thing: Sony Ericsson update service is programmed in java, and lollylost100 has already managed to make the program dump update images decrypted, so we might have a chance with that.

Also, bootloader starts if you take out the battery, plug usb and then turn it back in. It goes on for 10 seconds, after that, it times out and reboots to normal. So maybe if we don't mess with the bootloader we can restore it no matter what happens to the rest of the flash (don't trust this much)

About the mtd partitions, there are only four visible to Android, but there have to be more.

Radio partition, recovery partition (if it flashes it will be somewhere, unless its just a kernel+ramdisk that boots when in 'safe mode'), bootloader and such. Where are they hidden?

I have a copy of the running configuration for the kernel from .16 version, if anybody wants, I can put it somewhere.

If you wan't to retrieve it from your phone just do:

cat /proc/config.gz > /sdcard/config.gz

from adb/local terminal.

@HunteronX: that error it gives you is because you need a dev firmware, or being able to do a 'su', to get root access, it's not a driver problem. If you do "adb shell" you get a terminal with user id 2000 (shell), but no way of getting id 0 (root) with official firmware (unless hacking).By the way, that post you pasted from me is very outdated and there's not much useful information so you can remove it from the first post :) Thanks for starting a new thread, hopefully we'll manage to keep it clean!

Regards, Biktor